mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-11-02 07:34:35 -05:00
InverleandAlexandre Alapetite
76e8993579
* Replace bcrypt challenge auth with direct password comparison Closes #2428 Highlights: * Replaced the bcrypt challenge authentication flow with direct password comparison against the bcrypt hash stored in the user configuration. * Removed the `bcrypt.js` dependency, so authentication no longer depends on JavaScript. * Removed the nonce and challenge mechanism and the `nonce` endpoint from the `javascript` controller. * Removed the JavaScript and HTML code used for the previous authentication flow. * Removed the `<noscript>` blocks that were only needed for the previous authentication flow. * Updated `FreshRSS_FormAuth::checkCredentials()` to accept the username, stored bcrypt hash, and plain-text password directly. * The stored password hash must still use the expected bcrypt format. * Empty or whitespace-only passwords are rejected even if the hash would otherwise match. * The bcrypt 72-byte limit is enforced during normal authentication. * Existing bcrypt passwords are handled correctly when the 72-byte limit cuts through a UTF-8 character. * Password input is no longer trimmed before authentication or password changes. Leading and trailing whitespace is therefore kept as part of the password. * Added `FreshRSS_FormAuth::passwordRequirementsMet()` to replace `FreshRSS_password_Util::check()`. * New passwords must be between 7 and 72 bytes by default. * The minimum length check can be disabled where needed. * Password requirements are now checked server-side for all password creation and update paths. * Added client-side byte-length validation for password fields using `TextEncoder` and `data-max-bytes`. * This gives better feedback for UTF-8 passwords. * Server-side validation remains authoritative. * Updated password handling in authentication, re-authentication, self-deletion, user creation, and user update paths so passwords are not trimmed automatically. * Added `FormAuthTest` to cover: * password length limits in bytes * UTF-8 passwords around the 72-byte limit * bcrypt truncation behavior during authentication * malformed and non-bcrypt hashes * empty passwords * authentication failures and log messages * Removed `bcrypt.js` from the documented dependencies and updated the authentication documentation. * Updated the installation and authentication views and JavaScript to match the new password handling. This simplifies the authentication flow, removes the client-side bcrypt challenge, makes password validation consistent between the client and server, and adds more test coverage while keeping compatibility with existing bcrypt password hashes. Because the password is now sent directly to the server instead of being processed by `bcrypt.js`, deployments should use HTTPS. Documentation for HTTPS setup can be handled separately. * Add test case with password truncated down to 71 characters * Compare log messages too during form auth tests * Mark the `getLastLog()` method as impure * Fix: Check password reqs against new password instead of current * Fix: Add custom JS validator for UTF-8, handle cut-off UTF-8 during login * Fix: Enforce password requirements everywhere server-side * Add TODO for updateUser in CLI * make readme * Fix extra.js in install.php * Don't report validity yet if the password is too short or not filled out * Simplify checking of whether to report validity * Fix: Do not trim password from user's input * Also `trim: false` in some userController paths * Use the proper argument order for PHPUnit's `assertSame()` * Remove `maxlength` in favor of `data-max-bytes` But add `pattern` again for some nojs support * make readme * composer run-script translations * Update i18n string for web form admin setting * i18n: fr * Minor whitespace --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
- Read this document on github.com/FreshRSS/FreshRSS/ to get the correct links and pictures.
- Version française
FreshRSS
FreshRSS is a self-hosted RSS feed aggregator.
It is lightweight, easy to work with, powerful, customizable, and has been translated into many languages.
It is a multi-user application with an anonymous reading mode. It supports custom tags. There is an API for (mobile) clients, and a Command-Line Interface.
Thanks to the WebSub standard, FreshRSS is able to receive instant push notifications from compatible sources, such as Friendica, WordPress, Blogger, Medium, etc.
FreshRSS natively supports basic Web scraping, based on XPath, for Web sites not providing any RSS / Atom feed. Also supports JSON documents.
FreshRSS offers the ability to reshare selections of articles by HTML, RSS, and OPML.
Different login methods are supported: Web form (including an anonymous option), HTTP Authentication (compatible with proxy delegation), OpenID Connect.
Finally, FreshRSS supports extensions for further tuning.
- Official website: https://freshrss.org
- Demo: https://demo.freshrss.org
- License: GNU AGPL 3
Feedback and contributions
Feature requests, bug reports, and other contributions are welcome. The best way is to open an issue on GitHub. We are a friendly community.
To facilitate contributions, the following option is available:
Screenshot
Disclaimer
FreshRSS comes with absolutely no warranty.
Documentation
- User documentation, where you can discover all the possibilities offered by FreshRSS
- Administrator documentation for detailed installation and maintenance related tasks
- Developer documentation to guide you in the source code of FreshRSS and to help you if you want to contribute
- Contributor guidelines for those who want to help improve FreshRSS
- Check
AGENTS.mdfor coding conventions (both for humans and AI agents).
- Check
Requirements
- A recent browser like Firefox / IceCat, Edge, Chromium / Chrome, Opera, Safari.
- Works on mobile (except a few features)
- Light server running Linux or Windows
- It even works on Raspberry Pi 1 with response time under a second (tested with 150 feeds, 22k articles)
- A Web server: Apache2.4+ (recommended), nginx, lighttpd (not tested on others)
- PHP 8.2+
- Required extensions: cURL, DOM, JSON, XML, session, ctype
- Recommended extensions: PDO_SQLite (for export/import), GMP (for API access on 32-bit platforms), IDN (for Internationalized Domain Names), mbstring (for Unicode strings), iconv (for charset conversion), ZIP (for import/export), zlib (for compressed feeds)
- Extension for database: PDO_PGSQL or PDO_SQLite or PDO_MySQL
- PostgreSQL 10+ or SQLite or MariaDB 10.6+ or MySQL 8.0+
Installation
If you want a rolling release with the newest features and security fixes,
or want to help testing or developing the next release,
you can use the edge branch.
If you prefer fewer updates, you can use the latest branch.
It is more stable but at the price of less security and more known bugs,
as fixes are not backported to older versions.
New versions are published a few times a year.
See the latest release
and the list of releases.
Automated install
 |
 |
 |
 |
 |
 |
 |
 |
For more cloud hosting options, see the list of cloud providers or Chatons (a directory of ethical hosting providers).
Manual install
- Get FreshRSS with git or by downloading the archive
- Put the application somewhere on your server (expose only the
./p/folder to the Web) - Add write access to the
./data/folder for the webserver user - Access FreshRSS with your browser and follow the installation process
- or use the Command-Line Interface
- Everything should be working :) If you encounter any problems, feel free to contact us.
- Advanced configuration settings can be found in config.default.php and modified in
data/config.php. - When using Apache, enable
AllowEncodedSlashesfor better compatibility with mobile clients.
More detailed information about installation and server configuration can be found in our documentation.
Advice
- For better security, expose only the
./p/folder to the Web.- Be aware that the
./data/folder contains all personal data, so it is a bad idea to expose it.
- Be aware that the
- The
./constants.phpfile defines access to the application folder. If you want to customize your installation, look here first. - If you encounter any problem, logs are accessible from the interface or manually in
./data/users/*/log*.txtfiles.- The special folder
./data/users/_/contains the part of the logs that are shared by all users.
- The special folder
FAQ
- The date and time in the right-hand column is the date declared by the feed, not the time at which the article was received by FreshRSS, and it is not used for sorting.
- In particular, when importing a new feed, all of its articles will appear at the top of the feed list regardless of their declared date.
Extensions
FreshRSS supports further customizations by adding extensions on top of its core functionality. See the repository dedicated to those extensions.
Internationalization: 20+ languages. Translation progress
| Language | Progress | |
|---|---|---|
| العربية (ar) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Azərbaycanca (az) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Беларуская (be) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Čeština (cs) | ￭￭￭￭￭￭￭￭･･ 81% | contribute |
| Deutsch (de) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Ελληνικά (el) | ￭￭￭￭￭￭￭･･･ 75% | contribute |
| English (en) | ￭￭￭￭￭￭￭￭￭￭ 100% | contribute |
| English (United States) (en-US) | ￭￭￭￭￭￭￭￭￭￭ 100% | contribute |
| Español (es) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| فارسی (fa) | ￭￭￭￭￭￭￭￭￭･ 98% | contribute |
| Suomi (fi) | ￭￭￭￭￭￭￭￭￭･ 91% | contribute |
| Français (fr) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| עברית (he) | ￭￭￭￭･･････ 41% | contribute |
| Magyar (hu) | ￭￭￭￭￭￭￭￭￭･ 98% | contribute |
| Bahasa Indonesia (id) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Italiano (it) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| 日本語 (ja) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| 한국어 (ko) | ￭￭￭￭￭￭￭￭･･ 80% | contribute |
| Lietuvių (lt) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Latviešu (lv) | ￭￭￭￭￭￭￭￭･･ 81% | contribute |
| Nederlands (nl) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Occitan (oc) | ￭￭￭￭￭￭￭･･･ 73% | contribute |
| Polski (pl) | ￭￭￭￭￭￭￭￭￭￭ 100% | contribute |
| Português (Brasil) (pt-BR) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Português (Portugal) (pt-PT) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Русский (ru) | ￭￭￭￭￭￭￭￭￭･ 98% | contribute |
| Slovenčina (sk) | ￭￭￭￭￭￭￭￭･･ 80% | contribute |
| Türkçe (tr) | ￭￭￭￭￭￭￭￭￭･ 99% | contribute |
| Українська (uk) | ￭￭￭￭￭￭￭￭￭･ 98% | contribute |
| 简体中文 (zh-CN) | ￭￭￭￭￭￭￭￭￭･ 95% | contribute |
| 正體中文 (zh-TW) | ￭￭￭￭￭￭￭￭￭･ 97% | contribute |
APIs & native apps
FreshRSS supports access from mobile / native apps for Linux, Android, iOS, Windows and macOS, via two distinct APIs: Google Reader API (best), and Fever API (limited features, less efficient, less safe).
| App | Platform | Free Software | Maintained & Developed | API | Works offline | Fast sync | Fetch more in individual views | Fetch read articles | Favourites | Labels | Podcasts | Manage feeds |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Capy Reader | Android | ✓ | ✓✓ | GReader | ✓ | ⭐⭐⭐ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Readrops | Android | ✓ | ✓✓ | GReader | ✓ | ⭐⭐⭐ | – | ✓ | ✓ | – | – | ✓ |
| FeedMe | Android | – | ✓✓ | GReader | ✓ | ⭐⭐ | – | – | ✓ | ✓ | ✓ | ✓ |
| FocusReader | Android | – | ✓✓ | GReader | ✓ | ⭐⭐ | – | – | ✓ | ✓ | ✓ | ✓ |
| Read You | Android | ✓ | ✓✓ | GReader | ✓ | ⭐⭐ | ✓ | ✓ | ✓ | – | – | ✓ |
| Your News | Android, iOS | – | ✓✓ | GReader | – | ⭐ | ✓ | ✓ | ✓ | – | – | – |
| Fluent Reader Lite | Android, iOS | ✓ | ✓ | GReader | ✓ | ⭐⭐ | – | – | ✓ | – | – | – |
| FeedFlow | Android, iOS, Linux, macOS, Windows | ✓ | ✓✓ | GReader | ✓ | ? | ? | ? | ✓ | ? | – | ✓ |
| FriRSS | Web (self-hosted) | ✓ | ✓✓ | GReader | – | ? | ✓ | ✓ | ✓ | ✓ | – | ✓ |
| App | Platform | Free Software | Maintained & Developed | API | Works offline | Fast sync | Fetch more in individual views | Fetch read articles | Favourites | Labels | Podcasts | Manage feeds |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fluent Reader | Windows, Linux, macOS | ✓ | ✓✓ | GReader | ✓ | ⭐ | – | ✓ | ✓ | – | – | – |
| RSS Guard | Windows, GNU/Linux, macOS, OS/2 | ✓ | ✓✓ | GReader | ✓ | ⭐⭐ | – | ✓ | ✓ | ✓ | ✓ | ✓ |
| NewsFlash | GNU/Linux | ✓ | ✓✓ | GReader | – | ⭐⭐ | – | ✓ | ✓ | ✓ | – | – |
| Newsboat | GNU/Linux, macOS, FreeBSD | ✓ | ✓✓ | GReader | – | ⭐ | – | ✓ | ✓ | – | ✓ | – |
| FluentFlame Reader | Windows, Linux, macOS | ✓ | Work in progress | GReader | ✓ | ? | ? | ? | ✓ | – | – | – |
| App | Platform | Free Software | Maintained & Developed | API | Works offline | Fast sync | Fetch more in individual views | Fetch read articles | Favourites | Labels | Podcasts | Manage feeds |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vienna RSS | macOS | ✓ | ✓✓ | GReader | ? | ? | ? | ? | ? | ? | ? | ? |
| Readkit | iOS, macOS | – | ✓✓ | GReader | ✓ | ⭐⭐⭐ | – | ✓ | ✓ | – | ✓ | $ |
| Reeder Classic | iOS, macOS | – | ✓✓ | GReader | ✓ | ⭐⭐⭐ | – | ✓ | ✓ | – | – | ✓ |
| lire | iOS, macOS | – | ✓✓ | GReader | ? | ? | ? | ? | ? | ? | ? | ? |
| Unread | iOS | – | ✓✓ | Fever | ✓ | ? | ? | ? | ✓ | – | – | – |
| Fiery Feeds | iOS | – | ✓✓ | Fever | ? | ? | ? | ? | ? | – | – | – |
| Netnewswire | iOS, macOS | ✓ | Work in progress | GReader | ✓ | ? | ? | ? | ✓ | – | – | ✓ |
Included libraries
Additional credits
- Based on a modified version of the MINZ framework.
- Some icons come from the GNOME project
- Fonts: Open Sans, Lato, Spectral
Alternatives
If FreshRSS does not suit you for one reason or another, here are alternative solutions to consider:
- Kriss Feed
- Leed
- And more… (but if you like FreshRSS, give us a vote!)